China-Aligned Group Deploys ShadowPad and IOX Proxy in Targeted Espionage Across Asia

GLOBAL, May 1, 2026, 08:19 UTC

• SHADOW-EARTH-053 targets government and critical infrastructure in eight Asian countries since December 2024
• Attack chain employs ShadowPad malware, IOX Proxy backdoor, and Windows Management Instrumentation Command (WMIC)
• Campaign leverages living-off-the-land techniques to avoid detection and maintain persistence

A China-aligned threat group, tracked as SHADOW-EARTH-053, has been conducting a prolonged espionage campaign against government agencies and critical infrastructure across Asia, cybersecurity researchers reported. Active since at least December 2024, the group has targeted organizations in eight countries using a sophisticated multi-stage attack chain.

The campaign combines the ShadowPad backdoor, IOX Proxy malware, and Windows Management Instrumentation Command (WMIC) — a legitimate Windows tool often abused for stealthy command execution. This blend of custom malware and living-off-the-land tactics allows the attackers to evade traditional security defenses and maintain long-term access.

ShadowPad, a modular backdoor known for its use in espionage, serves as the primary foothold. IOX Proxy acts as a secondary implant facilitating encrypted communications with command-and-control servers. WMIC is leveraged to execute commands and scripts without dropping new binaries, reducing the risk of detection.

The group’s focus on government entities and critical infrastructure underscores the strategic intent behind the campaign. By infiltrating these sectors, SHADOW-EARTH-053 can potentially gather sensitive intelligence and disrupt essential services.

Researchers emphasize the campaign’s stealth and persistence. The attackers employ careful operational security, including encrypted communications and staged payloads, to avoid triggering alerts. The use of legitimate system tools complicates detection efforts by security teams.

This activity aligns with previous patterns attributed to China-aligned espionage groups, though SHADOW-EARTH-053 exhibits unique tooling and targeting. The campaign’s duration and geographic spread suggest a well-resourced operation with ongoing objectives.

Organizations in Asia’s government and infrastructure sectors are advised to review their network logs for signs of WMIC misuse and unusual outbound connections associated with ShadowPad or IOX Proxy. Enhanced monitoring of system tools and network traffic can help detect early indicators.

The risk of data exfiltration and operational disruption remains high as the attackers maintain persistent access. Failure to identify and remediate infections could lead to significant intelligence losses and infrastructure vulnerabilities.

Given the campaign’s complexity, affected organizations should consider incident response engagements with cybersecurity experts specializing in advanced persistent threats. Deploying endpoint detection tools capable of spotting living-off-the-land techniques is critical.

Looking ahead, the evolving tactics of SHADOW-EARTH-053 highlight the need for continuous threat intelligence sharing and proactive defense measures. The group’s use of WMIC and proxy malware may inspire similar campaigns targeting other regions or sectors.

What to Do Now

• Audit use of WMIC and other native Windows tools for unauthorized activity.
• Monitor network traffic for connections to known ShadowPad and IOX Proxy command-and-control domains.
• Apply endpoint detection and response (EDR) solutions with behavior-based detection.
• Conduct threat hunting exercises focused on living-off-the-land techniques.
• Engage cybersecurity incident response teams if suspicious activity is detected.

How to Secure Yourself

• Limit administrative privileges and restrict WMIC usage to trusted personnel.
• Keep operating systems and security software up to date.
• Implement network segmentation to contain potential breaches.
• Use multi-factor authentication to protect critical accounts.
• Educate staff on phishing and social engineering tactics often used to initiate such attacks.

2026 Update

By mid-2026, SHADOW-EARTH-053 has expanded its toolset, incorporating additional proxy malware variants and refining its use of legitimate system tools to bypass emerging detection technologies. Continued vigilance and adaptive security postures remain essential to counter this evolving threat.

This report draws on multiple corroborating sources, including cybersecuritynews.com, which first detailed the campaign’s technical aspects and targeting scope.

https://cybersecuritynews.com/china-aligned-attackers-use-multi-stage-espionage-campaign/